rhadamanthys | cade479a0b203af759b0f82c80d4b95ca46abe3a4f665f365953eb5e25fe9284

Analysis

max time kernel
357s
max time network
360s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 23:04

Target

rh_0.6.0.exe
Size

355KB
MD5

464ea1bd9930cd4ecae392d7214c3905
SHA1

525be920ce25cf340d8e47a0f3fd993a908449fc
SHA256

cade479a0b203af759b0f82c80d4b95ca46abe3a4f665f365953eb5e25fe9284
SHA512

73bcb3c6119a73ccd34d8300cf4e4fc3b4abf4f7cdbba49d9ad341931785e36dc98258b0e759fe999c31b56320533f228bee8755838cb7850797ef5f14ad3aa3
SSDEEP

6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqrsb:gf2R/EEkCQFYDwRqw

Score

10^/10

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rh_0.6.0.exe

description pid process target process

PID 2316 created 1232 2316 rh_0.6.0.exe Explorer.EXE
Deletes itself 1 IoCs

Processes:

dialer.exe

pid process

2496 dialer.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rh_0.6.0.exedialer.exe

pid process

2316 rh_0.6.0.exe
2316 rh_0.6.0.exe
2496 dialer.exe
2496 dialer.exe
2496 dialer.exe
2496 dialer.exe

description	pid	process	target process
PID 2316 created 1232	2316	rh_0.6.0.exe	Explorer.EXE

pid	process
2496	dialer.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rh_0.6.0.exe

description	pid	process	target process
PID 2316 wrote to memory of 2496	2316	rh_0.6.0.exe	dialer.exe
PID 2316 wrote to memory of 2496	2316	rh_0.6.0.exe	dialer.exe
PID 2316 wrote to memory of 2496	2316	rh_0.6.0.exe	dialer.exe
PID 2316 wrote to memory of 2496	2316	rh_0.6.0.exe	dialer.exe
PID 2316 wrote to memory of 2496	2316	rh_0.6.0.exe	dialer.exe
PID 2316 wrote to memory of 2496	2316	rh_0.6.0.exe	dialer.exe

memory/2316-8-0x0000000000360000-0x00000000003CD000-memory.dmp

Filesize
436KB

Download
memory/2316-1-0x0000000002E80000-0x0000000003280000-memory.dmp

Filesize
4.0MB

Download
memory/2316-2-0x0000000002E80000-0x0000000003280000-memory.dmp

Filesize
4.0MB

Download
memory/2316-3-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download
memory/2316-5-0x0000000002E80000-0x0000000003280000-memory.dmp

Filesize
4.0MB

Download
memory/2316-6-0x0000000075730000-0x0000000075777000-memory.dmp

Filesize
284KB

Download
memory/2316-0-0x0000000000360000-0x00000000003CD000-memory.dmp

Filesize
436KB

Download
memory/2496-7-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2496-11-0x0000000001F90000-0x0000000002390000-memory.dmp

Filesize
4.0MB

Download
memory/2496-10-0x0000000001F90000-0x0000000002390000-memory.dmp

Filesize
4.0MB

Download
memory/2496-13-0x0000000001F90000-0x0000000002390000-memory.dmp

Filesize
4.0MB

Download
memory/2496-12-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download
memory/2496-15-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download
memory/2496-16-0x0000000075730000-0x0000000075777000-memory.dmp

Filesize
284KB

Download
memory/2496-17-0x0000000001F90000-0x0000000002390000-memory.dmp

Filesize
4.0MB

Download